Forum Discussion
NimbostratusIrule to send client ip to SPLUNK Server
Hello All.
I am currently using "x-forwarded-for" to send client ip address to the backend server. But that doesn't really help our security team to have visibility on the client ip address or user data.
I am trying to create irule which can send client ip address to SPLUNK server for client ip address visibility on splunk (for both http adn non-http traffic).
can any body share irule for sending client ip address plus user data to splunk server for both http and non-http traffic?
1 Reply
Only1masterbla1Cirrus
You could use HSL (high speed logging) https://devcentral.f5.com/wiki/iRules.HSL.ashx https://devcentral.f5.com/wiki/iRules.HSL__send.ashx
example below:
when CLIENT_ACCEPTED { set hsl [HSL::open -proto UDP -pool syslog_server_pool] } when HTTP_REQUEST { Log HTTP request as local7.info; see RFC 3164 Section 4.1.1 - "PRI Part" for more info HSL::send $hsl "<190> [IP::local_addr] [HTTP::uri]\n" }
